Esc1 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/esc1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 03 Jan 2024 12:00:00 +0000Suspicious Certificate Issuance and Authentication via AD CS ESC1https://feed.craftedsignal.io/briefs/2024-01-03-esc1-certificate-abuse/Wed, 03 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-03-esc1-certificate-abuse/This analytic detects suspicious certificate issuance with a Subject Alternative Name (SAN) via Active Directory Certificate Services (AD CS) followed by immediate authentication, using Windows Security Event Logs (EventCode 4887 and 4768), which, if successful, can lead to privilege escalation and environment compromise.This detection identifies potential abuse of Active Directory Certificate Services (AD CS) through the ESC1 attack vector. This involves the issuance of a suspicious certificate containing a Subject Alternative Name (SAN) followed by its immediate use for authentication. The activity is detected by correlating Windows Security Event Logs, specifically Event ID 4887 (certificate issuance) and Event ID 4768 (Kerberos authentication). This technique exploits improperly configured certificate templates within AD CS, which can lead to unauthorized privilege escalation and full compromise of the Windows environment. The activity is significant as a successful attacker can gain domain administrator privileges using tools like Certipy, potentially leading to lateral movement, data exfiltration, or deployment of ransomware. The detection leverages the Splunk ES datamodel and is based on work published by SpecterOps and others.

Attack Chain

  1. The attacker compromises a user account or gains access to a system with permissions to request certificates.
  2. The attacker identifies vulnerable certificate templates that allow for Subject Alternative Name (SAN) spoofing, specifically user principal name (UPN).
  3. The attacker crafts a certificate request, forging the SAN to impersonate a high-privilege user (e.g., Domain Admin).
  4. The attacker submits the malicious certificate request to the AD CS server, triggering Event ID 4887, which indicates a certificate with a SAN was issued.
  5. The AD CS server, if misconfigured, issues the certificate based on the tampered request.
  6. The attacker uses the issued certificate to request a Kerberos Ticket Granting Ticket (TGT) for the impersonated user, generating Windows Event ID 4768 with the certificate thumbprint.
  7. The attacker successfully authenticates as the high-privilege user.
  8. The attacker uses the elevated privileges to perform malicious activities, such as lateral movement, data exfiltration, or domain compromise.

Impact

A successful attack can lead to complete domain compromise. By exploiting misconfigured certificate templates, attackers can escalate privileges to domain administrator, gaining full control over the Active Directory environment. This allows them to move laterally within the network, access sensitive data, deploy ransomware, or disrupt critical services. The impact can be widespread, affecting all systems and users within the compromised domain, causing significant financial and reputational damage.

Recommendation

  • Enable enhanced audit logging on AD CS and within Group Policy Management for CS server as outlined in the Certified Pre-Owned whitepaper (reference URL).
  • Deploy the Sigma rule "Detect Suspicious Certificate Issuance with SAN" to detect Event ID 4887 with attributes indicative of ESC1 exploitation.
  • Deploy the Sigma rule "Detect Kerberos Authentication with Newly Issued Certificate" to detect Event ID 4768 that correlates with recent certificate issuance activity.
  • Review and remediate any certificate templates that allow for arbitrary SAN values to prevent ESC1 exploitation as described in the SpecterOps whitepaper.
  • Throttle correlation by RequestId/ssl_serial to reduce false positives and improve detection fidelity, as mentioned in the "how_to_implement" section.
]]>highadvisoryesc1certificate_abuseprivilege_escalationwindows